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Safeguarding the Nation’s Drinking Water: 
EPA and Congressional Actions 



Summary 

The events of September 11, 2001, focused heightened attention on the security 
status of the nation’s drinking water supplies and the vulnerability of this critical 
infrastructure sector to attack. Congress since has enacted security requirements for 
public water systems and has provided funding for vulnerability assessments, 
emergency planning, and drinking water research. The Environmental Protection 
Agency (EPA), the lead federal agency for the water sector, has worked with water 
utilities, state and local governments, and federal agencies to improve the drinking 
water security. 

The Public Health Security and Bioterrorism Preparedness and Response Act 
of 2002 (P.L. 107-188) amended the Safe Drinking Water Act to require some 8,400 
community water systems to assess vulnerabilities and prepare emergency response 
plans. It authorized funding for these activities and for emergency grants to states 
and utilities, and it directed EPA to review methods to prevent, detect, and respond 
to threats to water safety and infrastructure security. The act did not require water 
systems to make security upgrades to address potential vulnerabilities. Since 
FY2002, Congress has appropriated funds annually for EPA to work with states and 
the water sector to improve the security of drinking water supplies. 

In the Homeland Security Act of 2002 (P.L. 107-296), Congress created a 
Department of Homeland Security (DHS) and gave the DHS responsibility for 
assessing and protecting the nation’s critical infrastructures. However, the act did not 
transfer EPA’s water security functions, and the 2003 Homeland Security 
Presidential Directive (HSPD-7) affirmed EPA’s lead role in protecting the water 
infrastructure. Under this directive, EPA has responsibility for developing and 
providing tools and training on improving security to roughly 53,000 community 
water systems and 16,000 municipal wastewater treatment facilities. 

In the 109 th Congress, the Department of Homeland Security FY2007 
appropriations act (P.L. 109-295) authorized the DHS to regulate for three years 
high-risk chemical facilities, but the law excluded from coverage drinking water and 
wastewater treatment facilities. In the 1 10 th Congress, legislation was introduced 
bills, including a reported bill, S. 2145, proposed to expand water security 
requirements for certain high-risk water systems. 

Although EPA, states, localities, and water utilities have taken steps to address 
security concerns, the security of the nation’s water supplies continues to attract 
congressional attention. Issues receiving attention have included the status of efforts 
by the water sector to improve security, whether to increase federal requirements, 
funding needs for water systems to make security improvements, the relative roles 
and responsibilities of EPA and DHS regarding the water sector, and the status of 
research and development of technologies to help water systems detect and address 
potential biological and chemical contaminants. This report reviews governmental 
and water utility efforts to improve drinking water security. 
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Safeguarding the Nation’s Drinking Water: 
EPA and Congressional Actions 

Background 

Ensuring the security of the nations’ drinking water supplies poses a substantial 
challenge, partly because the number of water systems is very large and also because 
the responsibility for protecting drinking water safety is shared among federal, state 
and local governments and utilities. Nationwide, there are some 158,000 public 
water systems, and these systems range greatly in size, serving from as few as 25 
persons to more than 1 million persons. Roughly 53,000 of all public water systems 
are community water systems (CWSs) that serve the same residences year-round. 1 
These 53,000 systems provide water to approximately 282 million people. Nearly 
400 community systems serve more than 100,000 people and provide water to nearly 
half of the total population served. Because water supplies support many uses (from 
drinking water to fire suppression), their disruption could have significant impacts. 2 

A 1996 executive order on critical infrastructure protection (E. O. 13010), 
included water supply systems as one of eight national infrastructures vital to the 
security of the United States. 3 In 1997, the President’s Commission on Critical 
Infrastructure Protection, created by the executive order, issued a report on the 
vulnerabilities of these infrastructure sectors and strategies for protecting them. The 
Commission identified three attributes crucial to water supply users: water must be 
available on demand, it must be delivered at sufficient pressure, and it must be safe 
for use. 4 Actions affecting any of these factors could be debilitating for the 
infrastructure and also for the communities that depend on it. 

Major threats to water supplies include physical destruction of facilities or 
distribution systems, biological or chemical contamination of supplies, and cyber 



1 Another 19,174 public water systems are non-transient, non-community water systems 
(NTNCWS), such as schools or factories, that have their own water supply and generally 
serve the same individuals for more than six months but not year-round. More than 86,000 
other public water systems are transient non-community water systems (TNCWS), such as 
campgrounds and gas stations, that provide their own water to transitory customers. 

2 For a broader review of security issues in the water resources sector (including dams and 
sewage treatment plants), see CRS Report RL32 1 89, Terrorism and Security Issues Facing 
the Water Infrastructure Sector, by Claudia Copeland. 

3 For a review of critical infrastructures, related security issues and protection initiatives, 
and activities within the Department of Homeland Security, see CRS Report RL30153, 
Critical Infrastructures: Background, Policy, and Implementation, by John D. Moteff. 

4 The President’s Commission on Critical Infrastructure Protection, Critical Foundations: 
Protecting America’s Infrastructures. Report of the President’s Commission on Critical 
Infrastructure Protection, Appendix A, Sector Summary Reports, October 1997, p. A-45. 
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attacks. The 1997 Commission found that drinking water systems had inadequate 
protection against the threat of chemical or biological contamination, and that 
technology was insufficient to allow detection, identification, measurement, and 
treatment of highly toxic, waterborne contaminants. Water utilities were also found 
to be vulnerable to cyber attacks as they rely increasingly on computers to control 
water flow and pressure. Information sharing was identified as the most immediate 
need, whereas warning and analytical capabilities and research and development all 
were found to be insufficient. 

In response to these findings and related developments, President Clinton, in 
1998, issued Presidential Decision Directive (PDD) 63 on critical infrastructure 
protection. Under this directive, a public/private partnership was established to put 
in place prevention, response, and recovery measures to ensure the security of the 
nation’s critical infrastructures against criminal or terrorist attacks. PDD-63 
designated the Environmental Protection Agency (EPA) as the lead federal agency 
for the water supply sector, and EPA appointed the Association of Metropolitan 
Water Agencies (AMWA) to coordinate the water sector. However, before 
September 11, 2001, the main focus of PDD-63 efforts for all critical infrastructure 
sectors was on cybersecurity. Subsequently, the breadth and depth of efforts to 
protect the nation’s critical infrastructures have expanded significantly. 

EPA Efforts To Increase Drinking Water Security 

In 2003, President Bush issued Homeland Security Presidential Directive 7 
(HPSD-7), which affirmed EPA as the lead federal agency for coordinating the 
protection of the nation’s critical infrastructure for the water sector. Under this 
directive, EPA is responsible for developing and providing tools and training on 
improving security to roughly 53,000 community water systems and 16,000 
municipal wastewater treatment facilities. 

To carry out its water sector responsibilities, EPA established a Water Security 
Division within the Office of Ground Water and Drinking Water. This Division 
works with drinking water and wastewater utilities, states, tribes, and other 
stakeholders to improve the security of these utilities and improve their ability to 
respond to security threats and breaches. Among its responsibilities and activities, 
the Water Security Division provides security and antiterrorism-related technical 
assistance and training to the water sector. Although the Water Security Division was 
established in 2003, the Office of Water had provided assistance to its stakeholders 
for a number of years. 

Security-related activities undertaken by EPA and the water sector have fallen 
into five general categories, including (1) establishing an information center for 
drinking water alerts or incidents, (2) developing vulnerability assessment tools, (3) 
identifying actions to minimize vulnerabilities, (4) revising emergency operations 
plans, and (5) supporting research on biological and chemical contaminants 
considered to be potential weapons of mass destruction. Several key government and 
private sector efforts are reviewed below. 

Information Sharing and Analysis. One goal of PDD-63 in 1998 was to 
establish an Information Sharing and Analysis Center (ISAC) for each critical 
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infrastructure sector. With assistance from EPA and the Federal Bureau of 
Investigation, the Association of Metropolitan Water Agencies has led the effort to 
develop and implement an ISAC for water utilities. The WaterlSAC provides a 
secure, Web-based communications link between the water sector and federal 
homeland security, law enforcement, intelligence, environmental, and public health 
agencies. This system gathers, analyzes, and disseminates threat information specific 
to the water sector, and is a comprehensive source of security and disaster 
preparedness information for drinking water and wastewater utilities. 5 The 
WaterlSAC is supported by membership fees and EPA grants. It has been 
supplemented with the Water Security Channel (WaterSC), which provides free 
email notification of water security alerts and other information issued by federal 
government agencies. 

Tools and Technical Assistance. EPA has worked with its water sector 
partners to provide practical tools and technical assistance to utilities on a wide range 
of security matters. In 2000, the American Water Works Association Research 
Foundation (AWWARF) and the Sandia National Laboratories, with EPA support, 
initiated a project to develop a methodology for utilities to use to assess their 
vulnerabilities and develop plans to minimize identified risks. The project was 
expedited after September 11, 2001, and completed in November 2001, and many 
large water systems used this risk assessment methodology to conduct vulnerability 
assessments. States and drinking water organizations, in collaboration with EPA, 
developed additional vulnerability assessment tools, with a particular focus on the 
needs of smaller communities. To help cover the costs of conducting vulnerability 
assessments and preparing emergency response plans, EPA awarded a total of $5 1 
million in grants to community water systems that serve more than 100,000 persons. 

While direct grants have not been available for smaller water systems, a 
considerable amount of technical assistance has been aimed at helping these systems, 
which typically may have less capacity to address security concerns. EPA has used 
“train-the-trainer”grants to build a pool of environmental professionals that has 
provided training and technical assistance to water systems serving fewer than 50,000 
people. 6 In addition, on-site assistance for vulnerability assessment and emergency 
response planning was made available to small and medium wastewater utilities at 
no cost through the Wastewater Operator Training Program. 

Technical assistance also has been provided through numerous guidance 
documents designed to help water utilities address a range of security concerns. 7 A 
key product is the Response Protocol Toolbox: Planning for and Responding to 



5 For further information on the Water ISAC, see [http://www.waterisac.org], 

6 EPA generally has not performed security training; rather, the agency has delivered 
training at locations across the country through stakeholder organizations and other federal 
partners. Organizations that have provided training include professional associations, such 
as the American Water Works Association, the Water Environment Federation, and the 
National Rural Water Association. Congress has provided some grant funds to these 
organizations, through EPA, to support their water security training activities. 

7 Water security reports, guidance documents, directives, and information on EPA security 
activities are available at [http://cfpub.epa.gov/safewater/watersecurity/index.cfm]. 
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Contamination Threats to Drinking Water Systems, which is intended to help public 
water systems respond to contamination threats and incidents. The “toolbox” 
includes separate modules that address water utility planning, contamination threat 
management, site characterization and investigation, water sample analysis, public 
heath response, and remediation and recovery. 8 Paralleling the toolbox, EPA 
developed response guidelines to help water utilities, emergency responders, and 
other officials during the management of an ongoing contamination threat or 
incident. 

As a sector, drinking water utilities acted relatively quickly to assess 
vulnerabilities, upgrade emergency response plans, and take some initial steps to 
improve security of this critical infrastructure. The Office of Homeland Security’s 
2003 National Strategy for the Physical Protection of Critical Infrastructure and Key 
Assets reported that the water sector had taken great strides to protect its critical 
facilities and systems, and had focused on categories of possible attacks that could 
have the greatest health or economic consequences. 9 However, the report noted that 
the water sector needed better threat information to prioritize investments on security 
measures. It also reiterated the need for research and development of new monitoring 
and analytic capabilities to enhance detection of biological, chemical, and 
radiological contaminants that could be introduced to the water supply. 

Research. EPA has participated in various research and development projects 
related to water security, including research to evaluate the ability of drinking water 
treatment systems to remove and inactivate biological and chemical agents. The 
agency also has supported research efforts to determine the fate and transport of 
contaminants within rivers and streams and within water treatment plants and 
distribution systems, and to develop biodetectors for detecting and quantifying 
biological contaminants in drinking water supplies. 

To coordinate and oversee research involving prevention and response to 
terrorist attacks, EPA’ s Office of Research and Development established the National 
Homeland Security Research Center (NHSRC) in 2002. The Center’s key areas of 
research involve water infrastructure protection, decontamination and consequence 
management, and threat and consequence assessment. 

In 2004, the NHSRC’ s Water Infrastructure Protection Division and the Office 
of Water’s Water Security Division developed a Water Security Research and 
Technical Support Action Plan to define a specific program of research and technical 
support for protecting drinking water and wastewater facilities from terrorist threats 
and attacks. The action plan, which was reviewed by the National Research Council 



8 U.S. Environmental Protection Agency, Response Protocol Toolbox: Planning for and 
Responding to Drinking Water Contamination Threats and Incidents, August 2004. 
Available at [http://www.epa.gov/watersecurity/pubs/rptb_response_guidelines.pdf] . 

9 Office of Homeland Security, The National Strategy for the Physical Protection of Critical 
Infrastructures and Key Assets, February 2003, p. 39. The categories included (1) physical 
damage or destruction of critical assets (including the intentional release of toxic chemicals), 
(2) actual or threatened contamination of the water supply, (3) cyber attack, and (4) 
interruption of services from another infrastructure (such as energy supply). 
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(NRC), addressed drinking water supply, water treatment, finished water storage, 
and distribution systems. It identified major research needs in the following areas: 

• protecting physical and cyber infrastructure; 

• identifying drinking water contaminants; 

• improving monitoring systems and analytical methods for drinking 
water; 

• containing, treating, decontaminating, and disposing of 
contaminated water and material; 

• contingency planning; 

• addressing infrastructure interdependencies; 

• risk assessment and communication; and 

• protecting wastewater treatment and collection systems. 10 

A key concern the NRC expressed regarding the action plan was that it did not 
discuss the financial resources that would be required to complete the proposed 
projects and to implement countermeasures needed to improve water security. The 
NRC recommended that EPA try to quantify the costs and benefits associated with 
the research and technical support projects. The NRC further noted that more 
emphasis was needed on communicating the value of water and increased security, 
because water rate increases would likely be needed to generate the resources needed 
to implement counter measures. 11 

In a progress report on the action plan, EPA reported that more than 100 projects 
had been initiated to address the needs listed in the plan. 12 Projects have included a 
review of early warning systems, a tracer studies guide for use by water utilities, a 
treatability guide for biological contaminants in water, a review of emerging 
detection technologies for water contaminants, a review of the impacts of biological 
toxins on water systems, and performance verifications of the effectiveness of 
monitoring, treatment, and decontamination technologies. The Water Infrastructure 
Protection Division has lead responsibility for much of this research and has been 
producing tools, guides, and other products for use by water utility operators, public 
health officials, and emergency responders. 

For several years, EPA’s major water security research effort has involved the 
Water Security Initiative (formerly called the WaterSentinel Initiative), which is a 
demonstration project to develop a model contamination warning system for drinking 
water systems. The goal of the initiative is to establish pilot early warning systems 
through intensive water monitoring and surveillance in selected cities. As noted 
below, Congress has given partial support to the initiative. Using the resources 
available, EPA published interim guidance for the Water Security Initiative in May 



10 U.S. Environmental Protection Agency, EPA’s Role In Water Security Research: The 
Water Security Research and Technical Support Action Plan, EPA/600/R-04/063, March 
2004. 

11 National Academy of Sciences, A Review of the EPA Water Security Research and 
Technical Support Action Plan: Parts I and II, National Academy Press, 2003. 

12 U.S. Environmental Protection Agency, Water Security Research and Technical Support 
Action Plan — Progress Report for 2005, p. 5-7. 
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2007, and established the first contaminant warning system pilot in July 2007. The 
agency plans to award grants for additional pilot projects in March 2008. 

Funding for Drinking Water Security Activities 

Since 2001, Congress has provided funds annually to EPA to improve the 
security of public water supplies. The Emergency Supplemental Appropriations Act 
for FY2002 (P.L. 107-117) provided EPA with $175.6 million for emergency 
expenses to respond to the September 1 1 attacks and to support counterterrorism 
activities. The accompanying conference report, H.Rept. 107-350, specified that 
approximately $90 million was for improving security at EPA laboratories, 
performing drinking water vulnerability assessments, and anthrax decontamination 
activities. Another $5 million was for state grants for counterterrorism coordinators 
to work with EPA and water utilities in assessing drinking water safety. Congress 
has continued to provide roughly $5 million for these state grants each year. 

During FY2002, EPA allocated roughly $89 million of the amount provided in 
the emergency supplemental appropriation to support security enhancements at the 
nation’s drinking water systems. Of this amount, EPA targeted approximately $80 
million to: (1) provide grants to the largest drinking water systems to conduct 
vulnerability assessments and enhance emergency response plans; (2) provide 
technical assistance on vulnerability assessments and emergency response plans to 
small and medium drinking water systems; and (3) refine security-related detection, 
monitoring, and treatment tools. Another $4 million was used to accelerate the 
development and testing of counterterrorism tools, support vulnerability assessment 
training, provide technical assistance, and conduct and implement research on 
redesign and detection for collection and treatment systems. EPA also used funds to 
develop tools and provide training for medium and small drinking water systems to 
assess vulnerabilities and develop emergency response plans. In addition, EPA 
allocated $5 million to the states to support homeland security coordination work 
involving EPA and drinking water utilities. 

EPA awarded approximately $5 1 million in water security grants to the 
community water systems that serve more than 100,000 individuals. Grants were 
made to roughly 400 publicly and privately owned community water systems for as 
much as $115,000 per grant. Utilities were able to use their grants to develop 
vulnerability assessments, emergency response plans, and security enhancement plans 
and designs. Utilities also could use grant funds for in-house or contractor support; 
however, funds could not be used for physical improvements. 

Although these grants were made only to large systems, EPA has worked with 
states and utilities to help meet the security needs of small and medium-sized 
drinking water systems . EPA provided roughly $20 million of FY 2002 supplemental 
funds directly to the states for technical assistance and training for drinking water 
systems serving fewer than 100,000 people. 

For FY2003, EPA requested $16.9 million to assist small and medium-sized 
systems with vulnerability assessments and emergency response plans, and $5 
million in grants to states to support homeland security coordination. The 
Consolidated Appropriations Resolution for FY2003 (P.L. 108-7), provided this 
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amount. It also contained several drinking water security earmarks, including $2 
million for the National Rural W ater Association to help small water systems conduct 
vulnerability assessments and $ 1 million for the American Water Works Association 
for water security training activities. 

As requested for FY2004, EPA received approximately $32 million for critical 
water infrastructure protection, including $5 million for state homeland security 
grants in P.L. 108-199. This funding supported states’ efforts to work with water and 
wastewater systems to develop and enhance emergency operations plans; conduct 
training in the implementation of remedial plans in small systems; and develop 
detection, monitoring and treatment technology to enhance water security. EPA used 
funds to assist the nearly 8,000 community water systems that serve water to 
populations between 3,300 and 100,000 and are subject to the Bioterrorism Act. P.L. 
108-199 also included $2 million for the Water ISAC to gather, analyze and 
disseminate sensitive security information to water and wastewater systems. 

For FY2005, EPA requested $5 million for state water security grants and $6. 1 
million for other critical infrastructure protection efforts. EPA’ s budget justification 
explained that the $21.3 million reduction reflected a shift in priorities from 
assistance and training on vulnerability assessments. (Under the Bioterrorism Act, 
community water systems were required to complete vulnerability assessments by 
June 30, 2004.) Congress provided the requested amount in the Consolidated 
Appropriations Act, FY2005 (P.L. 108-447). As in FY2004, the appropriated 
amount included $2 million for the Water ISAC. 

In the FY2006 budget request, the President again requested $5 million for state 
water security grants. The President also requested $44 million to launch the Water 
Sentinel Initiative, a demonstration project to develop a model contamination 
warning system, now called the Water Security Initiative. EPA initiated this project 
to meet its responsibilities under Homeland Security Presidential Directive (HSPD) 
9, which directed EPA to develop a surveillance and monitoring program to provide 
early detection in the event of a terrorist attack contaminating water. The goal of the 
initiative is to establish pilot early warning systems through intensive water 
monitoring and surveillance for certain chemical and biological contaminants in five 
cities. Further responding to HSPD-9, EPA proposed to form a laboratory network 
to support the monitoring and response requirements of the surveillance program. 13 

In EPA’s FY2006 appropriations act (P.L. 109-54), Congress provided $8.1 
million (after rescissions) of the $44 million requested for the Water Security 
Initiative. In recommending a large reduction, the House Appropriations Committee 
recommended that EPA develop clear goals for the initiative, seek the advice of the 
Science Advisory Board, and justify the request more clearly in the budget request 



13 U.S. Environmental Protection Agency, FY2006 Annual Performance Plan and 
Congressional Justification, Science and Technology, Homeland Security: Critical 
Infrastructure Protection, pp. S&T-21 - S&T-23. 




http://wikileaks.org/wiki/CRS-RL31294 



CRS-8 



for FY2007. 14 Congress also provided $5 mi llion ($4.93 after rescissions) for state 
water security grants. 

The FY2007 budget request included $4.95 million for state water security 
grants. Additionally, the request again included a significant amount, $41.7 million 
($33.6 million more than Congress provided for FY2006), for the Water Security 
Initiative (WSI). In its justification for the request, the agency noted that the program 
is an essential component of its water security activities, and explained that its 
purpose is to demonstrate an effective contamination warning system that could be 
used by drinking water utilities of various sizes. 

The EPA FY2007 funding bill, H.R. 5386, as passed by the House, would have 
provided $16.7 million (or $25 million less than requested) for the WSI. The Senate 
Appropriations Committee (S.Rept. 109-275) recommended $18.13 million, which 
was $23.6 million less than requested but $10 million above the FY2006 enacted 
level. The House Appropriations Committee report for H.R. 5386 (H.Rept. 109-465) 
stated that the committee’s recommended funding level for the initiative included 
money for one additional WSI pilot project, which should be located in a 
metropolitan area that is highly vulnerable from a homeland security threat 
perspective. Congress did not complete action on this appropriations bill. The final 
continuing appropriations resolution for FY2007 (P.L. 1 10-5, H.J.Res. 20) generally 
funded EPA at the FY2006 level, but EPA used its discretion and allocated $27 
million for the Water Security Initiative. 

For FY2008, EPA requested $25.6 million to support its water sector 
responsibilities to protect critical water infrastructure, including $21.88 million for 
the WSI. The agency proposed to use the requested funds to support the existing 
pilot and to establish additional pilots, with a goal of having all planned pilots under 
way by 2008. EPA also proposed to continue providing special assistance to high- 
priority drinking water systems under the Water Alliance for Threat Reduction 
program. The goal of this assistance is to ensure that water utilities have tools and 
information to prevent, detect, respond to, and recover from terrorist attacks, other 
intentional acts, and natural disasters. The request again included $4.95 million for 
state water security grants. 

The House approved EPA’s appropriations bill for FY2008, H.R. 2643 in June 
2007. The committee report for H.R. 2643 (H.Rept. 110-187, p. 98) recommended 
reducing the amount requested for the WSI by $3.88 million. The House 
Appropriations Committee explained that late action on the 2007 budget had delayed 
the obligation of funds for pilot projects until FY2008. In the Senate, the 
Appropriations Committee recommended a $ 10 million decrease for the initiative (S . 
1696, S.Rept. 110-91, p. 52), also noting that EPA plans to carry forward a large 
balance of unobligated funds. Both the House and Senate committees urged EPA to 
be prepared to report to the committees on the status and accomplishments of the 
WSI pilot projects. After applying the 1.56% rescission, the Consolidated 



14 U.S. Congress, House Committee on Appropriations, Department of the Interior , 
Environment, and Related Agencies Appropriation Bill, 2006, report to accompany H.R. 
2361, 109 th Cong., 1 st sess., H.Rept. 109-80, p. 94. 
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Appropriations Act for FY2008 (P.L. 1 10-161) provided $1 1.7 million for the WSI 
and $4.87 million for state grants. 

For FY 2009, EPA requested $2 1 .4 million for the Water Security Initiative, $1.3 
million for the Water Alliance for Threat Reduction, and $4.9 million for state grants . 
EPA proposed to use WSI funds to support two more pilots, for a cumulative total 
of five pilots. Additionally, EPA planned to continue working with sector partners 
to establish the Water Laboratory Alliance (WLA). The alliance would provide a 
network of laboratories that would be able to help confirm and speed responses to 
intentional contamination events. EPA further proposed to use FY2009 funds to 
continue to support research to develop methods to detect chemical and biological 
contaminants and to evaluate event detection software. The agency estimated that 
90% of high-concern contaminants lack validated analytical methods. 15 Congress did 
not pass specific EPA appropriations; rather, the consolidated appropriations act for 
FY2009 (P.L. 1 10-329) generally extended funding for federal programs at FY2008 
levels through March 6, 2009. 

Thus far, Congress has not provided funding in EPA appropriations for grants 
to public water systems specifically for making security improvements. However, 
EPA has identified numerous security measures that are eligible for funding through 
the Drinking Water State Revolving Fund (DWSRF) program. 16 Eligible measures 
include making facility improvements, such as adding fencing, cameras, and lighting; 
securing chemical and fuel storage; hiring guards; and adopting enhanced filtration 
and disinfection treatment. Congress has provided approximately $840 million 
annually for this program in recent years. However, it is uncertain how readily funds 
might become available for security measures, as the key purpose of the DWSRF is 
to facilitate compliance with federal drinking water regulations, and competition for 
these funds can be considerable. 

Another potential source of funding for community water systems is the State 
Homeland Security Grant Program, administered by the Department of Homeland 
Security (DHS). Congress provided $525 million for FY2007 and $950 million for 
FY2008 for this program, which provides assistance to states to detect, prevent, and 
respond to terrorist attacks. States are required to allocate 80% of the grant funds 
received under this program to localities, in accordance with their approved 
homeland security plans. Funds may be used for homeland security-related training 
and for protecting critical infrastructure, including making physical security 
improvements. Local public works agencies, including water districts, are eligible 
to receive funding from the state; however, most of these funds have been used to 
support first responders. 17 



15 U.S. Environmental Protection Agency, FY2009 Annual Performance Plan and 
Congressional Justification, Science and Technology, Homeland Security: Critical 
Infrastructure Protection, p. 70. 

16 See EPA Fact Sheet, Use of the Drinking Water State Revolving Fund (DWSRF) to 
Implemen t Security Measures at Public Water Systems, EPA 8 1 6-F-02-040, November 200 1 . 
Available at [http://www.epa.gov/safewater/dwsrf/pdfs/security-fs.pdf] . 

17 For information on DHS grant programs, see CRS Report RL32348, Selected Federal 

(continued...) 
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Bioterrorism Preparedness and Response Act of 2002 

In 2002, two major laws were enacted that address the security of the nation’s 
critical infrastructure. While the Homeland Security Act of 2002 broadly addressed 
critical infrastructure protection, the Bioterrorism Preparedness and Response Act of 
2002 specifically aimed at improving the security of drinking water supplies. 

Title IV of the Public Health Security and Bioterrorism Preparedness and 
Response Act of 2002 (P.L. 107-188, 42 U.S.C. 300i) amended the Safe Drinking 
Water Act (SDWA) to require community water systems serving more than 3,300 
individuals to conduct an assessment of their system’s vulnerability to terrorist 
attacks or other intentional acts to disrupt the provision of a safe and reliable drinking 
water supply. These water utilities were required to certify that they had conducted 
a vulnerability assessment and to submit a copy of the assessment to EPA. The act 
also required the utilities to prepare or revise emergency response plans incorporating 
the results of the vulnerability assessments no later than six months after completing 
them. (Table 1 outlines the schedule for the roughly 8,400 water systems that were 
required to submit vulnerability assessments to EPA and complete emergency 
response plans.) As required, EPA issued guidance on conducting vulnerability 
assessments, preparing emergency response plans, and addressing threats to assist 
smaller water systems that were not covered by the Bioterrorism Act. 18 EPA reports 
that the large- and medium-sized water systems achieved 100% compliance with the 
act’s requirements, while smaller systems achieved nearly 100% compliance. 

Table 1. Community Water System Requirements under the 

Bioterrorism Act 



System size by 
population served 
(est. no. of systems) 


Date for completing 
vulnerability assessments 


Date for completing 
emergency response plans 


100,000 or more 
(approx. 400) 


March 31, 2003 


September 30, 2003 


50,000 - 99,999 
(approx. 460) 


December 3 1 , 2003 


June 30, 2004 


3,301 - 49,999 
(approx. 7,500) 


June 30, 2004 


December 3 1 , 2004 



The act exempted the contents of the vulnerability assessments from disclosure 
under the Freedom of Information Act (except for information contained in the 



17 (...continued) 

Homeland Security Assistance Programs: A Summary, by Shawn Reese; and CRS Report 
RL34181, Distribution of Homeland Security Grants in FY2007 and P.L. 110-53, 
Implementing Recommendations of the 9/1 1 Commission Act, by Steven Maguire and Shawn 
Reese. 

18 EPA published Water Security Strategy for Systems Serving Populations Less than 
1 00,000/1 5MGD or Less (July 2002). 
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certification that identified the system and the date of the certification). As required 
by the Bioterrorism Act, EPA developed protocols to protect the vulnerability 
assessments from unauthorized disclosure. The act provides for civil and criminal 
penalties for inappropriate disclosure of information by government officials. 

The Bioterrorism Act authorized $160 million for FY2002, and such sums as 
maybe necessary for FY2003-FY2005, to provide financial assistance to community 
water systems to conduct vulnerability assessments, to prepare response plans, and 
for expenses and contracts to address basic security enhancements and significant 
threats. (Security enhancements could include purchase and installation of intruder 
detection equipment and lighting, enhancing security of automated systems, 
personnel training and security screening of employees or contractors, etc. Funding 
could not be used for personnel costs, plant operations, monitoring or maintenance.) 

For grants to states and water systems to assist in responding to emergency 
situations, the act authorized $35 million for FY2002, and such sums as may be 
necessary thereafter. Finally, the act authorized $15 million for FY2002, and such 
sums as may be necessary for FY2003 through FY2005, for EPA to review methods 
by which terrorists or others could disrupt the provision of safe water supplies, and 
methods for preventing, detecting, and responding to such disruptions. 

EPA and DHS Water Infrastructure Security Roles 

The Homeland Security Act of 2002 (P.F. 107-296) combined the functions of 
all or parts of 22 federal agencies and departments into a new Department of 
Homeland Security (DHS). The act gave key responsibility for critical infrastructure 
protection to the DHS, but did not transfer EPA water security functions to the new 
department. 19 

With the establishment of DHS, which has overall responsibility for critical 
infrastructure vulnerability assessment and protection, the relative roles and 
responsibilities of EPA and DHS were not clear. In late 2003, the White House 
issued Homeland Security Presidential Directive 7 (HSPD-7), which superseded 
PDD-63. This Directive established national policy and outlined the roles and 
responsibilities of federal departments and agencies regarding critical infrastructure 
protection. It identified EPA as the federal agency (Sector-Specific Agency (SSA)) 
with lead responsibilities for ensuring the protection of the water infrastructure sector 
from terrorist attacks or sabotage. Under HSPD-7, DHS is responsible for overall 
coordination and integration of national critical infrastructure protection efforts by 
federal, state, and local governments and the private sector, whereas EPA is 
responsible for developing and providing water security tools and training for the 
nation’s community water systems and municipal wastewater treatment facilities. 

Some additional articulation of EPA’s role was provided by HSPD-9, which 
established a national policy to defend the nation’s water, agriculture, and food 



19 For a review of DHS reorganization actions related to critical infrastructure protection, 
see CRS Report RL30153, Critical Infrastructures: Background, Policy, and 
Implementation, by John D. Moteff. 
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systems against terrorist attacks, major disasters, and other emergencies. This 
directive instructed EPA to develop a comprehensive surveillance and monitoring 
program to provide early detection of contaminants in water systems. HSPD-9 also 
directed EPA to develop an integrated network of water quality laboratories to 
support the surveillance program. EPA has pursued these responsibilities through its 
Water Security Initiative and Water Alliance for Threat Reduction program. 

As both EPA and DHS have responsibilities for protecting critical water 
infrastructure, the potential for overlap and duplication is perhaps unavoidable. EPA 
and DHS, for example, have separate communications and information- sharing 
networks, and have had different policy advisory groups. In recognition of the need 
for a coordinating entity for the water sector, the major drinking water and 
wastewater organizations established the Water Sector Coordinating Council 
(WSCC) in 2004. This council is associated primarily with DHS, but coordinates 
with both agencies. In 2005, EPA and DHS facilitated the formation of a parallel 
Water Sector Government Coordinating Council (GCC) to enable interagency and 
cross-jurisdictional coordination. Members include DHS, EPA, the U.S . Army Corps 
of Engineers, the Bureau of Reclamation, the Federal Energy Regulatory 
Commission, the Centers for Disease Control and Prevention, state water and 
wastewater associations, and others. Chaired by EPA and co-chaired by DHS, the 
GCC coordinates strategies, activities, policies, and communication across 
government entities. The WSCC and GCC work together to coordinate critical 
infrastructure protection activities within the water sector. 

A key requirement for DHS under HSPD-7 was to develop a national strategy 
to protect all critical infrastructure and key resources (CI/KR). In June 2006, DHS 
issued the National Infrastructure Protection Plan (NIPP). The NIPP is intended to 
provide a unifying structure for integrating CEKR protection efforts into one national 
program. More specifically, it describes processes for 1) setting security goals; 2) 
identifying key assets; 3) assessing risks; 4) prioritizing assets as a basis for 
allocating resources; 5) implementing protection programs; and 6) measuring the 
effectiveness of CEKR protection efforts. 20 

The NIPP called for each sector’ s lead agency to work with its sector to develop 
Sector Specific Plans (SSPs) consistent with the NIPP. All 17 SSPs were released 
in May 2007, and EPA’s Water SSP is one of seven plans that are publicly 
available. 21 Taken together, the NIPP and the SSP are intended to provide the 
structure necessary to coordinate and synchronize activities under various laws, 
presidential directives, strategies, and initiatives into a unified national approach to 
protecting critical infrastructure. The goal of the Water SSP is to develop the 
sector’s strategy and programs to protect CEKR assets, identify priorities based on 
risk analysis, describe the resources needed to protect CEKR, track progress, identify 
gaps, establish research and development priorities, and work with DHS to 
continuously improve the NIPP. The SSP also helps define the roles and 
responsibilities of EPA (as the Water Sector SS A) and other sector partners. Overall, 



20 The NIPP can be found at [http://www.dhs.gov/xprevprot/programs/editorial_0827.shtm], 

21 The Water Sector-Specific Plan is available online at [http://www.epa.gov/safewater/ 
watersecurity/pubs/plan_sec urity_watersectorspecificplan.pdf]. 
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the Water SSP is intended to assist drinking water and wastewater utilities to be 
better prepared to prevent, detect, respond to, and recover from terrorist attacks, other 
intentional acts, natural disasters, and other hazards. The plan’ s overarching goals are 
to 1 ) sustain protection of public health and the environment; 2) recognize and reduce 
risks in the water sector; 3) maintain a resilient infrastructure; and 4) increase 
communication, outreach, and public confidence. 

Issues and Legislation 

The 110 th Congress considered several bills addressing the security of public 
water supplies, but legislation was not enacted. A key water sector issue has involved 
the status and adequacy of public and private efforts to improve the security of public 
water systems. Because of actions on the part of drinking water utilities, EPA, and 
the Congress, vulnerability assessment and planning efforts in the water sector have 
proceeded more rapidly than those in certain other sectors (such as chemical 
facilities); however, it is unclear how much has been done within the sector to 
implement security upgrades. Although the Bioterrorism Preparedness and Response 
Act required community water systems to conduct vulnerability assessments and 
prepare emergency response plans, it did not require systems to make security 
upgrades to address any identified vulnerabilities. 22 

Chemical Facility Security. An issue relevant to the water sector that has 
received significant legislative attention for several years involves the security of 
chemical facilities, including certain water utilities that are located where a terrorist 
attack could cause harm to nearby populations. For water utilities, the primary 
concern is the onsite storage hazardous, gaseous chemicals (such as chlorine) that 
pose potential risks to local communities if released. 

The 109 th Congress. Several bills in the 109 th Congress targeted such high- 
consequence facilities within the water sector. S. 2855 proposed to amend SDWA 
to require community water systems to replace hazardous, gaseous chemicals with 
inherently safer technologies (1ST), for example, switching from the use of chlorine 
gas to liquid chlorine). S. 2855 also would have required EPA to provide grants to 
high-consequence facilities for use in paying capital expenditures needed to make the 
transition to the use of 1ST. S. 2781 andS. 1995 proposed to amend the Clean Water 
Act to address security at wastewater treatment facilities. 

The Senate Committee on Environment and Public Works reported a 
wastewater treatment facilities bill, S. 278 1 (S.Rept. 109-345), which did not contain 
1ST requirements but did authorize grants to wastewater treatment facilities for 
security-related efforts, including conducting vulnerability assessments, preparing 



22 SDWA § 1433(b) states that emergency response plans “shall include, but not be limited 
to, plans, procedures, and identification of equipment that can be implemented or utilized 
in the event of a terrorist or other intentional attack on the public water system. The 
emergency response plan shall also include actions, procedures, and identification of 
equipment which can obviate or significantly lessen the impact of terrorist attacks or other 
intentional actions on the public health and the safety and supply of drinking water provided 
to communities and individuals.” (42 U.S.C. 300i-2) 
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site security plans, and making security upgrades. An identical bill was offered in the 
110 th Congress (S. 1303). 

Broader chemical facility security bills also were offered in the 109 th Congress 
that had implications for water utilities. These bills generally would have authorized 
the Secretary of the Department of Homeland Security to regulate chemical facilities, 
including water treatment plants, that pose certain risks. S. 2145, as reported by the 
Senate Homeland Security and Governmental Affairs Committee (S.Rept. 109-332), 
and its companion bill, H.R. 4999, would have directed the Secretary of DHS to issue 
rules designating which chemical facilities would be subject to regulation, and 
establish security performance standards such facilities. Under these bills, facilities 
would have been required to submit to the DHS vulnerability assessments, security 
plans, and emergency response plans for terrorist incidents. H.R. 5695 (H.Rept. 109- 
707) shared several similarities with S. 2145 but would have exempted water 
facilities covered by the legislation from redundant requirements (such as conducting 
vulnerability assessments), unless the DHS determined that more stringent security 
requirements were needed. S. 2486 proposed to cover a wider range of facilities and 
establish a general duty to ensure that facilities would be designed, operated, and 
maintained in safe manner; the bill defined this obligation to include use of 
inherently safer technology to the maximum extent practicable. H.R. 1562 would 
have required consultation between DHS and EPA, and would have imposed stronger 
security and emergency planning measures, rather than requiring changes in 
technology. H.R. 2237 would have expanded EPA’s existing authority to oversee 
chemical facilities but would have required consultation with DHS. 

Several local government and water organizations, including the American 
Waterworks Association (AWWA), sought exemptions from S. 2145 and otherbills 
that proposed to give the DHS authority to regulate water utilities that use hazardous 
chemicals (such as chlorine gas). These stakeholders argued that EPA already has 
an established water security program and has been designated the lead agency for 
water infrastructure security. In general, the AWWA has opposed legislation that 
would require water utilities to switch treatment processes without considering 
specific utility circumstances and local water and climate characteristics. Others 
have argued that mandating the adoption of safer technologies is warranted because 
of the potential risk that hazardous chemicals, particularly gaseous chlorine, may 
pose to communities. 

The 109 th Congress included a chemical facility security provision in the DHS 
FY2007 appropriations act (P.L. 109-295, Section 550). The provision authorized 
the department to regulate, for three years, high-risk chemical facilities, excluding 
drinking water and wastewater treatment facilities and facilities in ports. The act 
directed DHS to establish risk-based security performance standards for designated 
chemical facilities, and to require these facilities to prepare vulnerability assessments 
and security plans. 

To implement this provision, the DHS promulgated regulations in June 2007 
that established Chemical Facility Anti-Terrorism Standards (CFATS). These 
standards require chemical facilities to report the amounts and types of chemicals on 
site so that DHS can determine whether a facility will be further regulated by CFATS 
rules. Regulated facilities are placed into one of four tiers, based on risk and 
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performance. The facilities placed in the highest-risk tier will be subject to the most 
stringent security required. Pursuant to P.L. 109-295, the CFATS regulations will 
sunset in October 2009. 

The 110 th Congress. Because of the scope and time limitation of the 
Department's authority to regulate chemical facilities, as well as implementation 
issues, chemical facility security remained on the congressional agenda. In particular, 
the interim final rule issued by DHS stated that it might preempt future state and 
local chemical facility security regulations. In response to this preemption language, 
the 110 lh Congress amended P.L. 109-295 in the Consolidated Appropriations Act, 
2008 (P.L. 110-161) to establish a state’s right to promulgate chemical facility 
security regulations that are at least as stringent as the federal chemical facility 
security regulations. P.L. 110-161 further provided that state regulations would be 
preempted only in the case of an actual conflict between federal and state regulations. 

Several other bills were introduced to modify DHS authority to regulate 
chemical facilities. Perhaps of most interest to the water sector was H.R. 5577 
(H.Rept. 110-550), the Chemical Facility Anti-Terrorism Act of 2008. Reported, 
amended, from the House Committee on Homeland Security in March 2008, H.R. 
5577 would have revised, expanded, and made permanent DHS’s authority to 
regulate chemical facility security. Currently, water and wastewater facilities are 
explicitly exempt from P.L. 109-295 and the CFATS regulations; however, these 
utilities were not categorically exempt under H.R. 5577. This legislation would have 
directed the DHS Secretary to maintain a list of covered chemical facilities 
determined to be of sufficient security risk, based on several criteria: 1 ) the l ik elihood 
that the facility will be the target of an attack; 2) the potential extent and l ik elihood 
of death or injury, or harm to the environment, critical infrastructure, national 
security, or the economy that could result from an incident; and 3) the proximity of 
the chemical facility to population centers. The bill also would have authorized DHS 
to designate any chemical substance as a “substance of concern” and to establish and 
revise the threshold quantity for designated substances. 

Further, H.R. 5577 proposed to require owners and operators of covered 
facilities to conduct vulnerability assessments and to develop and implement DHS- 
approved security plans. To address the possibility of redundant federal requirements, 
DHS would have been authorized to consider whether requirements under other laws 
(such as the Bioterrorism Preparedness Act) satisfied these requirements. Another 
provision would have required owners and operators of affected facilities to complete 
an analysis of “methods to reduce the consequences of a terrorist attack” (the bill did 
not use the term "inherently safer technologies"), and would have authorized the 
DHS Secretary to require higher risk facilities to implement such methods or 
technologies under certain conditions. As amended in markup, the Secretary would 
not been authorized to order drinking water or wastewater facilities to implement 
inherently safer technologies unless DHS provided funding to assist with the 
conversion. Also of relevance to the water sector was the provision authorizing DHS 
to order a facility assigned to the high-risk tier to cease operations if the facility 
failed to comply with a DHS compliance order. As reported, H.R. 5577 would have 
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authorized DHS to order the shut down of a water facility only if the facility's 
continued operation presented a clear danger to homeland security. 23 

The House Committee on Energy and Commerce, which traditionally has held 
jurisdiction over drinking water safety issues, was granted an extension for 
consideration of H.R. 5577 through May 2008. The bill was not referred to the House 
Committee on Transportation and Infrastructure, which has key jurisdiction over 
wastewater utilities. No further action occurred on this legislation. 

Assistance for Security Measures. Also at issue is the availability of 
funding for water systems to make security upgrades needed to address risks 
identified in their vulnerability assessments. Based on a limited assessment, EPA 
reported in 2005 that community water systems would need more than $1 billion to 
make security improvements. 24 The AWWA estimated that municipal water systems 
would have to spend more than $1.6 billion just to ensure control of access to critical 
water system assets. 25 Congress has not provided funding specifically for this 
purpose. 26 Although community water systems potentially are eligible to receive 
funding from the states through the DHS State Homeland Security Grant Program, 
competition for funds has been severe, and funds largely have gone to meet the needs 
of first responders. In an effort to address one element of this funding issue, the 
conference report for the Department of Homeland Security Appropriations Act for 
FY2005 (P.L. 108-334, H.Rept. 108-774) modified the definition of “local unit of 
government” specifically to include water districts. 27 Congress provided $525 
million for this grant program for FY2007 (P.L. 109-295), and $950 million for 
FY2008 (P.L. 110-161). 

In the 1 10 th Congress, the Water Security Act of 2007, S. 1968, would have 
authorized EPA to provide grants to drinking water and wastewater systems for 
security-related measures including vulnerability assessments, implementation of 
security enhancements, and developing or upgrading emergency response and site 
security plans. S . 1 968 also proposed to provide technical assistance to small utilities, 
and to require research on specific security topics. A similar bill, S. 1303, specifically 
targeted wastewater treatment facilities. S. 1303 would have authorized EPA to 
make grants to municipal wastewater treatment utilities for vulnerability assessments, 



23 For more information on this and other bills, see CRS Report RL33847, Chemical Facility 
Security: Regulation and Issues for Congress, by Dana A. Shea and Todd B. Tatelman. 

24 U.S. Environmental Protection Agency, Drinking Water Infrastructure Needs Survey and 
Assessment: Third Report to Congress, June 2005. EPA 816-R-05-001. EPA noted that 
many water systems had not adequately captured security needs when this assessment was 
conducted in 2003. The agency anticipates that security needs will be reported more 
completely in the next assessment. 

25 American Water Works Association, Protecting Our Water: Drinking Water Security in 
American After 9/11, Executive summary, 2003. 

26 As discussed on page 9 above, some security projects are eligible for funding under the 
EPA-administered drinking water SRF program. 

27 For information on DHS grant program funding for FY2008, see CRS Report RS22596, 
FY2008 Appropriations for State and Local Homeland Security , by Shawn Reese. 
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security enhancements, emergency response plans, and facility security plans. The 
bill also would have directed EPA to conduct research on wastewater infrastructure 
security. The chemical facility security bill, H.R. 5577, would have authorized $225 
million over three years to provide assistance to facilities that are required to adopt 
safer technologies to reduce the consequences of an attack. 

Water Supply Security Research. A major security concern for the water 
sector has been the need for research to develop real-time monitoring methods to 
detect contaminants, and to develop technologies to remove or inactivate them. The 
water industry and security experts have identified a particular need for research to 
develop monitoring technologies that can quickly detect contaminants in water that 
has already left a treatment plant for distribution to consumers. 

EPA has focused homeland security research on the detection, containment, and 
decontamination of chemical and biological agents that could be used in attacks on 
water systems. These efforts received limited support during the 109 lh Congress. For 
FY2006, EPA had requested $44 million for the Water Sentinel program (renamed 
the Water Security Initiative) to help address water utilities’ concerns regarding their 
ability to detect and respond to chemical and biological contaminants. 28 The agency 
has considered this initiative to be a key element of its effort to meet its water 
security responsibilities under HSPD-9; 29 however, Congress provided just $8.1 
million for the program for FY2006. In recommending a large reduction, the House 
Appropriations Committee commented that EPA should develop clear goals for the 
initiative, and justify the request more clearly in the budget request for FY2007. 30 

For FY2007, the Water Security Initiative (WSI) again failed to receive the 
requested support ($41 .7 million) from House and Senate appropriators. Action was 
not completed on the EPA funding bill, and the continuing resolution for FY2007 
(P.L. 1 10-5) generally funded EPA programs at the FY2006 level. However, EPA 
used its discretion and allocated $27 million to the Water Security Initiative, 
considerably more than the FY2006 appropriation. 

Similarly in the 1 1 0 th Congress, the House and Senate appropriations 
committees recommended reductions in the amount requested for this initiative for 
FY2008, but explained that the reductions were in response to the delayed obligation 
of FY2007 funds. Both committees urged EPA to be prepared to report on the status 
and accomplishments of the initiative’s pilot projects. The Consolidated 
Appropriations Act, 2008 (P.L. 110-161), included $11.7 million for the initiative. 



28 U.S. Environmental Protection Agency, FY2006 Annual Performance Plan and 
Congressional Justification, Science and Technology, Homeland Security: Critical 
Infrastructure Protection, p. S&T-21 - S&T-23. 

29 Homeland Security Presidential Directive -9 directs EPA to develop a comprehensive and 
fully coordinated surveillance and monitoring system for drinking water, including a 
laboratory network to support surveillance and response activities. 

30 U.S. Congress, House Committee on Appropriations, Department of the Interior, 
Environment, and Related Agencies Appropriation Bill, 2006, report to accompany H.R. 
2361, 109 th Cong., 1 st sess., H.Rept. 109-80, p. 94. 
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EPA requested $21.4 million for the Water Security Initiative for FY2009, and 
proposed to use the resources to support two new WSI surveillance and monitoring 
pilots, bringing the total number of pilot projects to five. In its budget justification, 
the agency explained that five projects would be sufficient to generate the range of 
data needed for the program to have broad application to a variety of utilities in high- 
risk cities nationwide. 31 EPA also proposed to continue supporting research 
evaluating analytical methods for high risk contaminants and developing a network 
of laboratories to help confirm and speed responses to intentional contamination 
events; the agency estimated that 90% of contaminants of high concern lack validated 
detection methods. Specific EPA appropriations were not enacted, and the 
consolidated appropriations act for FY2009 (P.L. 110-329) generally extended 
funding for federal programs at FY2008 levels through March 6, 2009. 



31 U.S. Environmental Protection Agency, FY2009 Annual Performance Plan and 
Congressional Justification, Science and Technology, Homeland Security: Critical 
Infrastructure Protection, p. 68-69. 




